2019 Security Recommendations

My 2019 Annual Security recommendations. These are recommendations I think you should follow to help keep your data and privacy safe online.

Browser: Firefox – Its open source and is the backbone of tor for a reason. I much prefer firefox to any other browser. Chrome is a close second but I do not like that its not open source. I only use Firefox for email and sites where I login otherwise, I use the next site listed as most secure for all of my searching, research, googling, etc. https://www.mozilla.org/en-US/firefox/

Most secure browser: Tor. Tor is designed for those times when you don’t want anyone to see what you are doing. TOR blocks your ISP, the government, etc. from seeing what you are doing online. It keep everything you are searching very secure. Researchers, journalists, the government, and criminals all use tor when they want their tracks to be private. The bad thing about Tor is that its slow because its rerouting your data and some functions on various websites won’t work. https://www.torproject.org

Mobile Browser – Firefox and Firefox Focus are my preferred go to browsers. I mostly use firefox focus 99% of the time. Focus is really fast and simple. If you want more privacy, there are various tor browsers for the web https://support.mozilla.org/en-US/kb/focus

Security add on for your browser/Adblock – uBlock – works for firefox and chrome and keeps away ads and other nonsense. This helps many pages load faster too. It will also prevent youtube ads. This is my goto addon when I install a new browser. https://www.ublock.org/

VPN – Cyberghost and others like NordVPN. If you are using a program like Kodi to watch TV/Movies you better be using a VPN. I used to solely recommend cyberghost because they were the cheapest quality VPN but now many others have dropped prices and offers sales/discounts. Its so much about which company but rather that you have one. When you use a VPN you entire computer is hidden from your ISP vs tor which just hides the tor browser. A VPN is a must when using public wifi like at a hotel or starbucks. https://www.cyberghostvpn.com/en_US/

Email: Protonmail – Anonymous email. Doesn’t track you. Keep your data/emails private and safe. https://protonmail.com/

Malware/adware – Malwarebytes – its free and very powerful. I use this every few weeks to check my machine. I recommend using this whenever your computer is acting slow/funky. Please consider buying the full version to support them. https://www.malwarebytes.com/

Antivirus – Honestly, windows defender that comes on your machine is probably good enough. Its all I personally use. Now on my wife’s machine I use Avira – Its free! She tends to need extra security! https://www.avira.com/

Firewall – I don’t use a firewall anymore now that windows defender does the job for me. But if I were to need the extra protection, I would use Zonealarm. A firewall is designed to stop all traffic you don’t approve to and from the internet – https://www.zonealarm.com/software/free-firewall/

Online Privacy – Why is it important and how do I keep my information private?

Online Privacy – Why is it important and how do I keep my information private?

There has been a lot of buzz recently about online privacy, however; this is not a new issue by any means. Online privacy has been a concern for years. Go do a quick google search for online privacy and you will see articles from 2010, 2008, etc. discussing the issue. What is new is that thanks to our government your ISP (company you buy your internet from i.e. Verizon, charter, time warner, etc.) will be allowed to sell your browsing habits. So first, why does this matter?

For the most part, it doesn’t. A large percent of what we do online is harmless. For example, me searching for a new video game in google will tell amazon I want that game. And ads on Facebook will be for that game. With Insurdinary, it will be able to keep your insurance on private and to compare insurance quotes, you would know that Insurdinary is better.Kind of cool in a sense that the internet knows what I want. This is also scary. Imagine that you think you are sick with a disease, and now amazon, google, health insurance companies, life insurance companies, future/current employers, know about it. The real question though is, should anyone be able to see what you are doing online? Is it their right? Should your ISP be able to spy on you? If you say OK, I would ask, would you allow your mortgage company to come in your house and go through your drawers? Because that is essentially what is happening. So yes, it is a concern and should be to anyone.

So, what can you do to prevent this from happening? There are a number of things and I am going to break this up so that it’s easier to understand. The important thing to remember is that you are never going to be 100% secure. But you can take steps to make it harder for anyone to spy on you. Think of it like an onion, the closer you are to the middle, the harder it is to get to you. The outer layers (i.e. no security) are easy to get to but several layers in takes more work. Also, keep in mind I am not discussing Malware, Viruses, etc here, I have other blog posts about that but I do always recommend antivirus software, malware software, and a good firewall, if you want to learn more about network access control, you can go to this page to find good information in this area.

To stop your ISP from spying on you (to stop just facebook/browser scroll down to the end):

For your computer/browser (for most home users):

Step 1 – get a VPN.

VPN – This is the first thing you need. I am not going to explain what a VPN is, just that it makes it so that your ISP (or job) cannot see what you are doing. They can only see that you are connected and using data. The great thing with VPNs is they are so versatile, you can use use them for a ton of things. VPNs, like iPlayer VPN, are used for program and show access no matter your location. Other VPNs protect sensitive information and protect your devices from cyberthreats. Now, the issue with VPN is that the VPN company can see what you are doing. So yes, they can sell your data just like your ISP. But I trust them more and most do not sell your data, just the shady bad ones do. However, keep in mind if you are doing something illegal, the VPN company will turn your information over to authorities if they are subpoenaed – no one is going to jail for you. You will also need to have a secure and fast connection so you can cater the software (click here to find some packages).

There are tons of options for paid and free ones. I personally like Hotspot shield, CyberGhost, and Windscribe because they have free versions. Here is a link to them:

https://www.hotspotshield.com/

https://www.cyberghostvpn.com

https://windscribe.com/

Step 2 – Start using Firefox.

Why? Because of the security and add-ons. Once you download Firefox, you need to install the following add-ons. They are: HTTPS Everywhere and 1 of the privacy/adblock addons I explained below. They will not affect your browsing experience, they will however make it much more secure. Additionally, use the private browsing mode of the browser.

And do these:

  1. Add NoScript, uBlock, Disconnect, or Privacy Badger to your Firefox add-ons. This prevents only scripts that you allow. I personally use uBlock and Privacy Badger together.
  2. Use DuckDuckGo search engine. This is a search engine that does not record/track your searches. You can very easily make this your default browser by going to your browser settings and its just as good as Google. https://duckduckgo.com/

For the most secure (for people who are more technically inclined):

Use Tor Browser. Tor browser with its default settings is going to be super secure. Its slower because of how it works to hide your identity but if you are searching things no one can know about, use this. https://www.torproject.org/

Download Tor Client. Tor is the best security that most home users can set up themselves. If you are a super high tech person and want something more secure you already know way more than what I am blogging about and shouldn’t even be reading this so this post is not for you.  https://www.torproject.org/

For your mobile device:

  1. Get a VPN. There are tons of free ones. You can use hotspot shield as I mentioned above. I use X-VPN on IOS. Keep it on always.
  2. For android, get Firefox browser and use the add-ons I mentioned above. Use private mode.
  3. For apple, use Firefox Focus browser. Apple does not allow Firefox add-ons, so use their focus browser. It’s actually much fast than any other mobile browser.
  4. Use DuckDuckGo search engine. This is a search engine that does not record/track your searches. https://duckduckgo.com/
  5. Use the web version of apps, not the apps themselves. For example, use facebook in the browser, rather than the app. Yea I know a big pain.

For those that want to be super secure, use a Tor browser. While there is no official mobile Tor browser there are tons that are free ones that use the Tor network. I personally have Onion browser for my iPhone.

To stop facebook and other internet companies like google, amazon, etc from spying on you:

1. You can always just not use the internet but come on…

2. Start using Firefox.

Why? Because of the security and add-ons. Once you download Firefox, you need to install the following add ons: uBlock and you can add Privacy Badger if you want double protection. Keep in mind, when using these add ons that some websites, like your online bank, might not work correctly, so if a site isn’t working correctly, you can simply turn them off for that site with the click of a button. It will remember, so its only the first time you visit that site.

3. Use DuckDuckGo search engine. This is a search engine that does not record/track your searches. You can very easily make this your default browser by going to your browser settings and its just as good as Google. https://duckduckgo.com/

4. Backup your data. Don’t wait for an attack for you to start backing up your data. Make sure you’re ready for any threat to your data. Visit sites like www.venyu.com/colocation/ to know more about cybersecurity.

Computer Adware, Viruses, Malware, and Security

Have problems with any of these? Here is a list of steps and freeware you should use to fix and protect your machine. Please note this is for PC only and all software is free:

1. Run rKill – This will stop all of the bad stuff from running so that you can run other software to delete it.

2. Run Malwarebytes and Ad-Aware

3. Run Combofix

4. Run Antivirus and keep it installed/running – ClamAv

5. Install security and keep it installed/running – Zonealarm

Once you have scanned your computer with the first 4 it should be clear. I would then recommend step 5 and keep it running on default settings. Also keep ClamAV running. The others should be run and used as there are problems on your machine.

 

phpBB forum security: How do I keep out spam?

This is a problem most of us who run any kind of database run into. How do I keep out spam? Of course there is an easy solution which is that you as a moderator approve each user request that comes in to determine if its a real person or bot but who has time for that? I know I do not. That is a full time job when you are running several applications requiring user registration – especially when 1000s of bots would try to register each day. So here are the things you can do, and these are specifically for phpBB forums but can be used for any software that requires registration and I am going to say whether these things are effective or not:

Non effective ways to prevent spam (bots just tear right through these but they still might help a little bit. Just do NOT rely on these):

– Email activation
– Captchas (the images where you write the numbers/letters that you see in the box)
– Asking for special characters on username/password
– Confirming email address

Effective ways to prevent spam

– Few registration attempts – this gives the bot less times to guess
– Questions – this will pretty much stop all spam. You need to ask questions that the computer will not know. Please not that bots have lists of 1000s of questions so you need to ask questions that are specific to your site only but is easy enough for your user base to answer. 2+2 is not good. But the last name of the author of this blog is ____, would be a good question. I have found these block nearly 100% of my spam. If you do start getting spam that means your questions are too easy.
– Using a service like akismet, which is awesome but doesnt currently have a plugin for phpBB. This works great for wordpress though.

So how do you add those questions in phpBB to prevent spam? There are two way and I encourage you to do both:

Method 1:

in the Admin control panel go to->spambot countermeasures->available plugins->Q&A->configure. From here you would create your questions.

Method 2:

In the admin control panel go to->users and groups->custom profile fields->then you would create a new field. From here make sure you require the question at registration.

For an example of a forum using these methods, check out my surfing forum and try to register: http://www.njsurfingclub.com/messageBoard

HTML5 Security and Vulnerability Issues

While these are fairly obvious they are something that users pushing HTML5 should be aware of. The first is vulnerability. What does this mean?

All of your code is essentially open source. While thats great for me, its not great for businesses and really anyone who is trying to make money off of their software. There are some ways around it but keep in mind that both HTML5 and Javascript are open source. Here is a good article that goes into it:

HTML5 – Not Designed for Business Applications

The next issue is security. Apparently the standards have not really been developed with security in mind as it will really be up the developers, users, and browsers. So there are going to be some issues when this is used more often…and of course this is the case with any new technology. Here is an article that goes into the topic:

Old hacking tricks work too easily in attacks on HTML5, security expert says